Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ab081a2baf5481dd649e7213fba08e5c366dd16d
https://github.com/WebKit/WebKit/commit/ab081a2baf5481dd649e7213fba08e5c366dd16d
Author: Tadeu Zagallo <[email protected]>
Date: 2026-10-10 (Sat, 10 Oct 2026)
Changed paths:
A JSTests/wasm/stress/bbq-argument-canonical-slots.js
A JSTests/wasm/stress/bbq-tail-call-indirect-evicted-local-argument.js
A JSTests/wasm/stress/get-local-repeated-on-stack.js
M Source/JavaScriptCore/jit/RegisterAtOffsetList.cpp
M Source/JavaScriptCore/jit/RegisterAtOffsetList.h
M Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
M Source/JavaScriptCore/wasm/WasmBBQJIT.h
M Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp
M Source/JavaScriptCore/wasm/WasmCallee.cpp
M Source/JavaScriptCore/wasm/WasmCallee.h
M Source/JavaScriptCore/wasm/WasmFunctionIPIntMetadataGenerator.cpp
M Source/JavaScriptCore/wasm/WasmFunctionIPIntMetadataGenerator.h
M Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp
Log Message:
-----------
[JSC] Allocate registers for locals in BBQ
https://bugs.webkit.org/show_bug.cgi?id=326017
rdar://188956724
Reviewed by Dan Hecht.
getLocal() copied a local into a fresh temp and setLocal() stored one back, so a
local was loaded at every read and stored at every write.
Let an expression stack entry reference a local rather than copy it, with
evacuateLocal()
replacing every reference to a given local in the stack with its current value.
For the function's busiest locals, ranked by IPInt, assign a callee-save
register
for the whole body, so a call preserves them by ABI. Assignments also store to
the
slot, since unwinding and frame reconstruction read locals there.
Tests: JSTests/wasm/stress/bbq-argument-canonical-slots.js
JSTests/wasm/stress/get-local-repeated-on-stack.js
* JSTests/wasm/stress/bbq-argument-canonical-slots.js: Added.
* JSTests/wasm/stress/get-local-repeated-on-stack.js: Added.
(async test):
* Source/JavaScriptCore/jit/RegisterAtOffsetList.cpp:
(JSC::RegisterAtOffsetList::bbqCalleeSaveRegisters): Deleted.
* Source/JavaScriptCore/jit/RegisterAtOffsetList.h:
* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:
(JSC::Wasm::BBQJITImpl::BBQJIT::BBQJIT):
(JSC::Wasm::BBQJITImpl::BBQJIT::getLocal):
(JSC::Wasm::BBQJITImpl::BBQJIT::assignToLocal):
(JSC::Wasm::BBQJITImpl::BBQJIT::setLocal):
(JSC::Wasm::BBQJITImpl::BBQJIT::teeLocal):
(JSC::Wasm::BBQJITImpl::BBQJIT::addTopLevel):
(JSC::Wasm::BBQJITImpl::BBQJIT::addLoopOSREntrypoint):
(JSC::Wasm::BBQJITImpl::BBQJIT::makeStackMap):
(JSC::Wasm::BBQJITImpl::BBQJIT::addReturn):
(JSC::Wasm::BBQJITImpl::BBQJIT::flushValue):
(JSC::Wasm::BBQJITImpl::BBQJIT::flushRegistersForException):
(JSC::Wasm::BBQJITImpl::BBQJIT::emitTailCall):
(JSC::Wasm::BBQJITImpl::BBQJIT::emitIndirectTailCall):
(JSC::Wasm::BBQJITImpl::BBQJIT::addCallIndirect):
(JSC::Wasm::BBQJITImpl::BBQJIT::willParseOpcode):
(JSC::Wasm::BBQJITImpl::BBQJIT::didFinishParsingLocals):
(JSC::Wasm::BBQJITImpl::BBQJIT::emitShuffle):
(JSC::Wasm::BBQJITImpl::BBQJIT::allocateWithHint):
(JSC::Wasm::BBQJITImpl::BBQJIT::loadIfNecessary):
(JSC::Wasm::BBQJITImpl::BBQJIT::bind):
(JSC::Wasm::BBQJITImpl::BBQJIT::unbind):
(JSC::Wasm::BBQJITImpl::BBQJIT::flushAllLocals):
(JSC::Wasm::BBQJITImpl::BBQJIT::assignPinnedLocals):
(JSC::Wasm::BBQJITImpl::BBQJIT::loadPinnedLocals):
(JSC::Wasm::BBQJITImpl::BBQJIT::assertPinnedLocalsAreResident):
(JSC::Wasm::BBQJITImpl::BBQJIT::unbindAllLocals):
(JSC::Wasm::BBQJITImpl::BBQJIT::tailCallArgumentSource):
(JSC::Wasm::BBQJITImpl::BBQJIT::evacuateLocal):
(JSC::Wasm::parseAndCompileBBQ):
(JSC::Wasm::BBQJIT::emitPushCalleeSaves):
(JSC::Wasm::BBQJIT::emitRestoreCalleeSaves):
(JSC::Wasm::BBQJITImpl::ControlData::touch): Deleted.
* Source/JavaScriptCore/wasm/WasmBBQJIT.h:
(JSC::Wasm::BBQJITImpl::BBQJIT::ControlData::flushAtBlockBoundary):
(JSC::Wasm::BBQJITImpl::BBQJIT::maxPinnedLocals):
(JSC::Wasm::BBQJITImpl::BBQJIT::isPinnedLocalRegister const):
(JSC::Wasm::BBQJITImpl::BBQJIT::assertPinnedLocalsAreResident):
(JSC::Wasm::BBQJITImpl::BBQJIT::ownsRegister const):
(JSC::Wasm::BBQJITImpl::BBQJIT::clobber):
* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:
(JSC::Wasm::BBQJITImpl::BBQJIT::getGlobal):
(JSC::Wasm::BBQJITImpl::BBQJIT::emitAtomicCompareExchange):
(JSC::Wasm::BBQJITImpl::BBQJIT::addRefI31):
(JSC::Wasm::BBQJITImpl::BBQJIT::marshallToInt):
(JSC::Wasm::BBQJITImpl::BBQJIT::addArrayNew):
(JSC::Wasm::BBQJITImpl::BBQJIT::addArrayNewDefault):
(JSC::Wasm::BBQJITImpl::BBQJIT::addArrayGet):
(JSC::Wasm::BBQJITImpl::BBQJIT::emitArraySetUnchecked):
(JSC::Wasm::BBQJITImpl::BBQJIT::addArrayFill):
(JSC::Wasm::BBQJITImpl::BBQJIT::emitCatchPrologue):
(JSC::Wasm::BBQJITImpl::BBQJIT::materializeToGPR):
(JSC::Wasm::BBQJITImpl::BBQJIT::marshallToI64): Deleted.
* Source/JavaScriptCore/wasm/WasmCallee.cpp:
(JSC::Wasm::IPIntCallee::IPIntCallee):
(JSC::Wasm::BBQCallee::calleeSaveRegistersImpl): Deleted.
* Source/JavaScriptCore/wasm/WasmCallee.h:
* Source/JavaScriptCore/wasm/WasmFunctionIPIntMetadataGenerator.cpp:
(JSC::Wasm::FunctionIPIntMetadataGenerator::hotLocals const):
* Source/JavaScriptCore/wasm/WasmFunctionIPIntMetadataGenerator.h:
(JSC::Wasm::FunctionIPIntMetadataGenerator::recordLocalRead):
(JSC::Wasm::FunctionIPIntMetadataGenerator::recordLocalWrite):
(JSC::Wasm::FunctionIPIntMetadataGenerator::enterLoop):
(JSC::Wasm::FunctionIPIntMetadataGenerator::exitLoop):
(JSC::Wasm::FunctionIPIntMetadataGenerator::loopDepth const):
(JSC::Wasm::FunctionIPIntMetadataGenerator::adjustLocalScore):
* Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp:
(JSC::Wasm::IPIntGenerator::getLocal):
(JSC::Wasm::IPIntGenerator::setLocal):
(JSC::Wasm::IPIntGenerator::teeLocal):
(JSC::Wasm::IPIntGenerator::addLoop):
(JSC::Wasm::IPIntGenerator::addEndToUnreachable):
(JSC::Wasm::IPIntGenerator::finalize):
Canonical link: https://commits.webkit.org/323294@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
